How do I get opendkim to sign emails?

For the PTR record in the reverse-mapping space, what they have there is fine. It's following RFC2317 which is a current Best Practice for delegating control of DNS records for networks smaller than /24. Just that what they have just seems to be a little unnecessary since the "range" notation is 0-255 which implies a /24 network size (but there is a delegation off to another server -- dig ns 0-255.17.200.84.in-addr.arpa )

So that part is fine, so long as your mail server is claiming to be ozarksneighborlyexchange.com in the EHLO exchange. But it really needs to be seed05.ozarksneighborlyexchange.com according to the rest of your post, i.e., it needs to be what your mail server knows itself to be (myhostname statement in your Postfix main.cf file)

Getting OpenDKIM working is as simple as setting up the signing keys, then telling Postfix to use it as a "milter" on outbound mail. The inet part is confusing you, that's referring to the transport mechanism, not the old inted daemon.

Here's my OpenDKIM conf file, modified for you: /etc/opendkim.conf

(the part I'm guessing is wrong is the Domain line... you want to use the domain part of your email addresses, user@domain.com, so if the domain part is ozarksneighborlyexchange.com for you, that's what goes in the DKIM configuration and determines what goes into DNS...)

# This is a basic configuration that can easily be adapted to suit a standard
# installation. For more advanced options, see opendkim.conf(5) and/or
# /usr/share/doc/opendkim/examples/opendkim.conf.sample.

# Log to syslog
Syslog                  yes
# Required to use local socket with MTAs that access the socket as a non-
# privileged user (e.g. Postfix)
UMask                   002

# Sign for example.com with key in /etc/mail/dkim.key using
# selector '2007' (e.g. 2007._domainkey.example.com)
Domain                 ozarksneighborlyexchange.com
KeyFile                 /etc/postfix/dkim.key
Selector                general

# Commonly-used options; the commented-out versions show the defaults.
#Canonicalization       simple
#Mode                   sv
#SubDomains             no
#ADSPDiscard            no

This assumes you generated the DKIM key called 'dkim', so you have a dkim.key and a dkim.pub file in your /etc/postfix directory. Adjust as necessary.

The next part is to tell the OpenDKIM where to listen. I use an Internet-type socket (inet) on the same machine as Postfix, so I have this in /etc/default/opendkim :

# Command-line options specified here will override the contents of
# /etc/opendkim.conf. See opendkim(8) for a complete list of options.
#DAEMON_OPTS=""
#
# Uncomment to specify an alternate socket
# Note that setting this will override any Socket value in opendkim.conf
#SOCKET="local:/var/run/opendkim/opendkim.sock" # default
SOCKET="inet:60001@localhost"

Then in the Postfix configuration, tell it where to find it and use it as a "milter".

In /etc/postfix/main.cf:

smtpd_milters = inet:localhost:60001
milter_default_action = accept

And the last piece is to put your public key in DNS so others can validate your signatures. In my case, my email address is milli@acmeps.com, so I have acmeps.com as the domain in the opendkim.conf file, then in DNS, I have:

general._domainkey      TXT     "v=DKIM1\; k=rsa\; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsnvxDB629MQXlcEMxgJIj18oH0BP5i02+v" "e3acN7yJ+n+smkMHUtaXSnSU2KN0ObySjkafUD93L1dL4KtafAKwE5gWSRbxrMBwWjwcmNgiCmtELbzt" "azlK8N6bbm2R1e7csUfHaFScSC5Lu+UD8JrFeovWfNCSpmV/kyrIlTTArNLK3R7mad4MmOZo/Agj9JRg" "0fa+cKCEl8Uo8RqY4xHX9fAlJTGT4MSvH3KEo9aL/tr7qZvcROA8dBaCLfdDnOqrBpfjFfZZSoCcYi6V" "bTKswYiAHABljoq5qhR7k+EdKv2Z+DRD2e2knld5kYXeMJXUENrZ2hYn4q25JEdET1TwIDAQAB"

You can see this with dig txt general._domainkey.acmeps.com.

Here you notice general showed up. That is the DKIM selector and needs to match in the opendkim.conf file and what you put in DNS. You didn't list what your selector is set to, but that's the other thing that'll bite ya.

This should get you over the hump!

milli

Posted 2016-03-25T12:52:50.253

Reputation: 1 682

How do I get opendkim to sign emails?

Answers